A network protocol fuzzing method and device, a storage medium and an electronic device
Patent Information
- Application Number
- CN202510173935.8
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2025-02-17
- Publication Date
- 2026-09-11
- Estimated Expiration
- 2045-02-17
Smart Images
Figure CN119743417B_ABST
Abstract
Description
Technical Field
[0001] This specification relates to the field of computer technology, and in particular to a method, apparatus, storage medium, and electronic device for fuzz testing network protocols. Background Technology
[0002] Nowadays, with the rapid development of technology, all kinds of applications are used in people's lives. However, when applications receive data through network communication, there are cases where the application crashes due to network protocol vulnerabilities. Therefore, vulnerability detection of the network protocols corresponding to the application has become a necessary matter to ensure that the application can run normally.
[0003] In related technologies, black-box testing is one of the methods used to detect vulnerabilities in network protocols. However, black-box testing lacks feedback information during the testing process, which leads to invalid mutation operations and reduces the efficiency of vulnerability detection. Therefore, how to reduce invalid mutation operations in black-box testing has become an urgent problem to be solved. Summary of the Invention
[0004] This specification provides a network protocol fuzzing method, apparatus, storage medium, and electronic device. It determines the mutability of bytes by performing mutation operations on target bytes of initial data to generate test data, and then generates mutated data based on the target bytes to perform network protocol testing on the program. This reduces the testing time for bytes with a non-mutability level and detects anomalies in the target program based on its runtime status, thereby improving the testing efficiency of fuzzing and the accuracy of network protocol vulnerability detection improved by byte-level mutation operations.
[0005] Firstly, embodiments of this specification provide a network protocol fuzz testing method, the method comprising:
[0006] Acquire the initial data input to the target program, and the first response data output by the target program in response to the initial data;
[0007] The target bytes of the initial data are subjected to a first mutation operation using a first mutation method to obtain the test data corresponding to the initial data.
[0008] Obtain the second response data corresponding to the test data, and determine the first difference between the first response data and the second response data based on the difference algorithm;
[0009] If the first difference indicates that the target byte is a volatile byte, then the initial data is subjected to a second mutation operation based on the second mutation method to obtain mutated data;
[0010] The mutated data is transmitted to the target program, and fuzz testing is performed on the network protocol of the target program.
[0011] The above technical solution enables the acquisition of initial data and corresponding first response data, as well as the second response data of the target program after performing a first mutation operation on the target byte of the initial data. Based on the difference between the first and second response data, when the target byte is determined to be a volatile byte, a second mutation operation is performed on the target byte to obtain mutated data. Fuzz testing of the target program's network protocol is then performed based on the mutated data. This allows the determination of byte variability through test data generated by performing mutation operations on the target byte of the initial data, and further network protocol testing of the program based on mutated data generated from the target byte. This reduces the testing time for bytes with a non-volatile variability level and improves the efficiency of fuzz testing and the accuracy of network protocol vulnerability detection improved by byte-level mutation operations.
[0012] In combination with the first aspect and the above implementation methods, in some possible implementation methods, the step of obtaining the initial data input to the target program and the first response data output by the target program in response to the initial data includes:
[0013] Obtain the network traffic data corresponding to the target program, and the protocol characteristics corresponding to the network traffic data;
[0014] Based on the protocol characteristics, the network traffic data is filtered to obtain the payload data corresponding to the network traffic data;
[0015] Iterate through the payload data to obtain initial data;
[0016] The initial data is input into the target program, and the first response data returned by the target program in response to the initial data is obtained, wherein the initial data is any data in the payload data.
[0017] The above technical solution filters out initial data for fuzz testing based on the network protocol characteristics of the network through which the target program transmits data. This allows for fuzz testing based on valid data, thereby improving the accuracy of program detection.
[0018] In combination with the first aspect and the above implementation methods, in some possible implementation methods, the step of performing a first mutation operation on the target bytes of the initial data using a first mutation method to obtain the test data corresponding to the initial data includes:
[0019] Perform bit flipping on the target byte in the initial data to obtain the test data corresponding to the initial data; or,
[0020] Perform bitwise addition on the target byte to obtain the test data corresponding to the initial data; or,
[0021] Perform a bitwise subtraction operation on the target byte to obtain the test data corresponding to the initial data.
[0022] The above technical solution employs bit flipping, bit addition, and bit subtraction to perform a first mutation operation on the target byte of the initial data, thereby obtaining test data that can be used to detect the target program.
[0023] In combination with the first aspect and the above implementation methods, in some possible implementation methods, obtaining the second response data corresponding to the test data and determining the first difference between the first response data and the second response data based on the difference algorithm includes:
[0024] The test data is transmitted to the target program, and second response data is obtained from the target program in response to the test data.
[0025] Obtain the first data length of the first response data and the second data length of the second response data;
[0026] A difference algorithm is used to determine a first difference between the first response data and the second response data based on the first response data, the second response data, the first data length, and the second data length.
[0027] In combination with the first aspect and the above implementation methods, in some possible implementation methods, after determining the first difference between the first response data and the second response data based on the difference degree algorithm, the method further includes:
[0028] Obtain a preset difference threshold and compare the first difference with the preset difference threshold;
[0029] If the first difference is less than the preset difference threshold, then the target byte is determined to be a volatile byte.
[0030] The above technical solution determines the byte type of the target byte by judging the first difference degree based on the preset difference degree threshold, thereby improving the efficiency of subsequent fuzz testing based on the byte type of the target byte.
[0031] In combination with the first aspect and the above implementation methods, in some possible implementation methods, before comparing the first difference degree with the preset difference degree threshold, the method further includes:
[0032] Obtain other payload data from the payload data, wherein the other payload data is the data in the payload data other than the initial data;
[0033] Obtain a third response data set corresponding to each of the other load data, wherein the third response data set includes the third response data of the target program in response to each of the other load data;
[0034] After comparing the first difference with the preset difference threshold, the method further includes:
[0035] If the first difference degree is greater than or equal to the preset difference degree threshold, then the second difference degree between the second response data and each of the third response data in the third response data set is obtained;
[0036] If each of the second differences is greater than the preset difference threshold, then the target byte is determined to be a volatile byte, the test data is added to the payload data, the test data is used as the initial data, and the process proceeds to the step of performing the first mutation operation on the target byte of the initial data using the first mutation method.
[0037] If the second difference degree is less than the preset difference degree threshold, then the target byte is determined to be a non-volatile byte.
[0038] By using the above technical solution, the byte type of the target byte is determined based on multi-layer judgment, and the probability of the impact caused by the mutation of the target byte is determined, thereby improving the accuracy of fuzz testing.
[0039] In combination with the first aspect and the above implementation methods, in some possible implementation methods, the step of performing a second mutation operation on the initial data based on the second mutation method to obtain mutated data includes:
[0040] If the target byte is a volatile byte, then obtain the byte sequence number of the target byte in the initial data;
[0041] Based on the byte sequence number, a preset string is inserted into the initial data to obtain mutated data, where the preset string is any string from the mutated character set; or,
[0042] Based on the byte sequence number, randomly generated characters are inserted into the initial data to obtain mutated data; or,
[0043] The target byte of the initial data is replaced with a randomly generated character to obtain mutated data.
[0044] By employing the above technical solutions, multiple second mutation methods are used to perform second mutation operations on the target bytes, resulting in mutated data for fuzz testing of network protocols, thereby improving the accuracy of fuzz testing of network protocols.
[0045] In combination with the first aspect and the above implementation methods, in some possible implementation methods, the step of performing a second mutation operation on the initial data based on the second mutation method to obtain mutated data includes:
[0046] If the target byte is a non-volatile byte, the test state of the target byte is determined based on a preset probability;
[0047] If the test status indicates that the target byte needs to be tested, then proceed to the step of inserting a preset string into the initial data based on the byte sequence number.
[0048] In combination with the first aspect and the above implementation methods, in some possible implementation methods, the step of transmitting the mutated data to the target program and performing fuzz testing on the network protocol of the target program includes:
[0049] The mutated data is transmitted to the target program to obtain the running status of the target program;
[0050] If the running status indicates that the target program has encountered an error, then obtain the kernel file that records the error of the target program;
[0051] Restart the target program.
[0052] By using the above technical solution, the running status of the target program's mutated data is obtained, the impact caused by the mutated data is determined, and program vulnerabilities in the target program's network protocol are identified, thereby improving the accuracy of fuzz testing of the network protocol.
[0053] Secondly, embodiments of this specification provide a network protocol fuzz testing method, the method comprising:
[0054] A response data acquisition unit is used to acquire initial data input to the target program, and first response data output by the target program in response to the initial data;
[0055] The test data acquisition unit is used to perform a first mutation operation on the target byte of the initial data using a first mutation method to obtain the test data corresponding to the initial data.
[0056] A difference determination unit is used to acquire second response data corresponding to the test data and determine a first difference between the first response data and the second response data based on a difference algorithm.
[0057] The mutated data acquisition unit is used to perform a second mutation operation on the initial data based on a second mutation method to obtain mutated data if the first difference indicates that the target byte is a volatile byte;
[0058] The testing unit is used to transmit the mutated data to the target program and perform fuzz testing on the network protocol of the target program.
[0059] Thirdly, embodiments of this specification provide a computer program product that stores at least one instruction, the at least one instruction being adapted to be loaded by a processor and executed in accordance with the above-described method steps.
[0060] Fourthly, embodiments of this specification provide a computer storage medium storing a plurality of instructions adapted for loading by a processor and executing the steps of the method described above.
[0061] Fifthly, embodiments of this specification provide an electronic device, including: a processor and a memory; wherein the memory stores a computer program adapted to be loaded by the processor and to execute the steps of the method described above. Attached Figure Description
[0062] To more clearly illustrate the technical solutions in this specification or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this specification. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0063] Figure 1 A schematic diagram illustrating a scenario for a network protocol fuzz testing method provided in an embodiment of this specification;
[0064] Figure 2 A flowchart illustrating a network protocol fuzz testing method provided in an embodiment of this specification;
[0065] Figure 3 A flowchart illustrating a network protocol fuzz testing method provided in an embodiment of this specification;
[0066] Figure 4 A schematic diagram illustrating an example of a first mutation operation provided in an embodiment of this specification;
[0067] Figure 5 A schematic diagram illustrating an example of a second mutation operation provided in an embodiment of this specification;
[0068] Figure 6 A schematic diagram of a network protocol fuzzy testing device provided in the embodiments of this specification;
[0069] Figure 7 A schematic diagram of a network protocol fuzzy testing device provided in the embodiments of this specification;
[0070] Figure 8 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this specification. Detailed Implementation
[0071] To make the features and advantages of this specification more apparent and understandable, the technical solutions in this specification will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this specification, and not all embodiments. Based on the embodiments in this specification, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this specification.
[0072] Please see Figure 1 This diagram illustrates a scenario for a network protocol fuzzing method provided in an embodiment of this specification. Figure 1 As shown in the embodiments of this specification, the network protocol fuzzing method can be applied to a test terminal to realize the fuzzing process of the network protocol. The scenario diagram provided in the embodiments of this specification mainly includes a test terminal 10 and a running terminal 20. The test terminal 10 can be a terminal with data processing capabilities, a server, or a microcomputer, such as a personal computer or laptop computer. The running terminal 20 can be a terminal with the target program installed, specifically a server or a microcomputer, such as a personal computer or laptop computer. One feasible method is that the test terminal 10 and the running terminal 20 can be the same terminal or different terminals, depending on the actual situation.
[0073] In the embodiments of this specification, the test terminal 10 acquires the initial data of the target program running on the running terminal 20, and the first response data output by the target program in response to the initial data. The test terminal 10 performs a first mutation operation on the target byte of the initial data using a first mutation method to obtain test data corresponding to the initial data, and acquires the second response data corresponding to the test data. Based on the difference degree algorithm, the first difference degree between the first response data and the second response data is determined. If the first difference degree indicates that the target byte is a volatile byte, a second mutation operation is performed on the initial data based on the second mutation method to obtain mutated data. The mutated data is transmitted to the running terminal 20 so that the target program of the running terminal 20 can perform fuzz testing on the network protocol of the target program according to the running state of the mutated data. Thus, the byte variability is determined by the test data generated by the mutation operation on the target byte of the initial data, and the network protocol of the program is tested based on the mutated data generated based on the target byte. This reduces the testing time for bytes with a non-volatile variability and tests the network protocol of the program based on the running state of the target program, thereby improving the testing efficiency of fuzz testing and the accuracy of network protocol vulnerability detection improved by byte-level mutation operations.
[0074] based on Figure 1 The scene shown below is an illustration; the following will combine... Figure 2 This document provides a detailed description of the network protocol fuzzing testing method provided in the embodiments of this specification.
[0075] Please see Figure 2 This is a flowchart illustrating a network protocol fuzzing method provided in an embodiment of this specification. Figure 2 As shown, the method may include the following steps S101-S105.
[0076] S101, Obtain the initial data input to the target program, and the first response data output by the target program in response to the initial data;
[0077] In one embodiment, initial data of the input target program is obtained. The target program can be a program to be tested. The initial data can be any data that can be recognized and run by the target program. The first response data output by the target program in response to the initial data is obtained. The first response data can be the data generated by the target program after running based on the initial data.
[0078] S102, the first mutation method is used to perform the first mutation operation on the target byte of the initial data to obtain the test data corresponding to the initial data;
[0079] In one embodiment, a first mutation operation is performed on the target byte in the initial data using a first mutation method to obtain test data after the target byte of the initial data has been mutated. The target byte can be any byte in the initial data. In order to ensure that all bytes in the initial data are traversed, a feasible method is to perform the first mutation operation on each byte in the initial data in sequence according to the byte sequence number of the byte in the initial data to obtain the test data corresponding to each byte. The test data can be the data obtained after performing the first mutation operation on the target byte of the initial data.
[0080] The first mutation method can be a way of mutating the target byte, specifically a bitwise operation such as bit flipping, bit addition, or bit subtraction. It should be noted that, in order to ensure the accuracy of the test of the target byte, a feasible method is to perform the first mutation operation on the target byte in sequence according to the various bitwise operations of the first mutation method to obtain at least one test data.
[0081] S103, Obtain the second response data corresponding to the test data, and determine the first difference between the first response data and the second response data based on the difference algorithm;
[0082] In one embodiment, test data is input to the target program, and second response data is obtained from the target program's output in response to the test data. A difference degree algorithm is used to calculate the first difference degree between the first response data and the second response data. The second response data can be the data generated by the target program running the test data, and the first difference degree can be used to characterize the degree of difference between the first response data and the second response data.
[0083] The difference algorithm can be expressed as shown in formula (1) to calculate the first difference between the first response data and the second response data. Formula (1) is:
[0084]
[0085] Where r can be the first response data, r′ can be the second response data, min_len(r,r′) can be the byte length of the shortest data between the first response data r and the second response data r′, and d1 can be the first byte length of r and r′. The edit distance of 1 byte, d2 can be the previous byte between r and r′. The edit distance of 1 byte, d3 can be the first byte of r and r′. The edit distance is byte-by-byte, where d4 can be the edit distance between the first min_len(r,r′) bytes of r and r′. The edit distance indicates the number of bytes that need to be modified to convert bytes in the first and second response data into the same data.
[0086] For example, if the first response data is "404 Not found" and the second response data is "405 Method NotAllowed", then min_len(r,r′) is 13, d1 is the edit distance between the first byte of r and r′, and since the first two bytes of r and r′ are both "40", d1 is 0; d3 is the edit distance between the first 7 bytes of r and r′, and since the first 7 bytes of r are "404 Not" and the first 7 bytes of r′ are "405 Met", it takes 3 bytes to edit the first 7 bytes of r′ to be the same as the first 7 bytes of r, so d3 is 3.
[0087] It should be noted that since min_len(r,r′) may not be divisible by 8, 4 or 2, a feasible method is to round up. For example, if min_len(r,r′) is 13, then d1 is 13 / 8, and after rounding up, d1 is 2.
[0088] S104, if the first difference indicates that the target byte is a volatile byte, then the initial data is subjected to a second mutation operation based on the second mutation method to obtain mutated data;
[0089] In one embodiment, the obtained first difference degree is compared with a preset difference degree threshold. If the first difference degree is less than the preset difference degree threshold, the first difference degree indicates that the target byte is a volatile byte. The initial data is then subjected to a second mutation operation based on a second mutation method to obtain mutated data corresponding to the initial data. The second mutation method can be to perform a second mutation operation on the target byte of the initial data using one or more methods. The mutated data can be the data obtained after performing the second mutation operation on the initial data. One initial data can correspond to one or more mutated data, and the specific settings can be configured according to the actual situation.
[0090] S105, transmit the mutated data to the target program and perform fuzz testing on the target program's network protocol;
[0091] In one embodiment, the generated mutated data is transmitted to the target program, and the running status of the target program after receiving the mutated data is monitored to perform fuzz testing on the network protocol of the target program. If the running status of the target program is abnormal, such as a crash, it indicates that there may be a vulnerability in the network protocol of the target program.
[0092] It should be noted that, since fuzz testing of the target program requires determining whether the target program will experience abnormal states due to the execution of mutated data, only one mutated data is transmitted to the target program at a time. After the test of that mutated data is completed, other mutated data are transmitted. This avoids the inability to determine the cause of the target program's abnormality due to the simultaneous transmission of multiple mutated data, thereby improving the testing efficiency of the target program's network protocol.
[0093] In the embodiments of this specification, by acquiring initial data and corresponding first response data, and second response data of the target program after performing a first mutation operation on the target byte of the initial data, and calculating the difference between the first response data and the second response data, when the target byte is determined to be a volatile byte, a second mutation operation is performed on the target byte to obtain mutated data. Fuzz testing of the network protocol of the target program is performed based on the mutated data. Thus, the byte volatility is determined by the test data generated by performing mutation operations on the target byte of the initial data, and the network protocol of the program is tested based on the mutated data generated based on the target byte. This reduces the testing time for bytes with a non-volatile volatility and tests the network protocol of the program based on the running state of the target program, thereby improving the testing efficiency of fuzz testing and the accuracy of network protocol vulnerability detection improved by byte-level mutation operations.
[0094] Please see Figure 3 This is a flowchart illustrating a network protocol fuzzing method provided in an embodiment of this specification. Figure 3 As shown, the method may include the following steps S201-S214.
[0095] S201, Obtain the network traffic data corresponding to the target program, and the protocol characteristics corresponding to the network traffic data;
[0096] In one embodiment, network traffic data generated by the target program during normal communication within a preset time period is obtained. The network traffic data can be data entering or exiting the target program through a network interface device to a specified network. The specified network can be a network used for data transmission with the target program. The protocol characteristics corresponding to the specified network are obtained. The protocol characteristics can be the protocol name, network address, communication port, etc. of the network protocol.
[0097] S202, filter network traffic data based on protocol characteristics to obtain the payload data corresponding to the network traffic data;
[0098] In one embodiment, based on the protocol characteristics of the network protocol used for data transmission by the target program, the acquired network traffic data is filtered to obtain payload data from the network traffic data. The payload data can be data from the network traffic data that can be used to test the network protocol. Specifically, it can be data that the target program needs to run and process after receiving it, as well as data generated after running. It is understood that data that the target program does not need to run and process cannot be used to perform fuzz testing on the network protocol of the target program, so such data is discarded.
[0099] S203, Traverse the payload data to obtain initial data;
[0100] S204, input the initial data from the payload data into the target program, and obtain the first response data returned by the target program in response to the initial data;
[0101] In one embodiment, each payload data is traversed to obtain initial data from the payload data, and the obtained initial data is transmitted to the target program. The first response data output by the target program after responding to the initial data is obtained. The initial data can be any data in the payload data. The method for obtaining the initial data in the payload data can be set according to the actual situation. For example, it can be selected according to the generation time of each payload data, and each payload data is determined as the initial data in the order of generation time.
[0102] It should be noted that the method of inputting initial data into the target program can be to use a specified network for transmission, so as to perform fuzz testing on the network protocol of the specified network based on the initial data.
[0103] S205, the first mutation method is used to perform the first mutation operation on the target byte of the initial data to obtain the test data corresponding to the initial data;
[0104] In one embodiment, a first mutation operation is performed on the target byte in the initial data using a first mutation method to obtain test data after the target byte of the initial data has been mutated. The target byte can be any byte in the initial data. To ensure that all bytes in the initial data are traversed, a feasible method is to perform the first mutation operation on each byte in the initial data sequentially according to the byte sequence number in the initial data to obtain the test data corresponding to each byte. The test data can be the data obtained after performing the first mutation operation on the target byte of the initial data.
[0105] The first mutation method can be a way to mutate the target byte, specifically a bitwise operation such as bit flipping, bit addition, or bit subtraction. It should be noted that, in order to ensure the accuracy of the test of the target byte, a feasible method is to perform the first mutation operation on the target byte in sequence according to the various bitwise operations of the first mutation method, and obtain at least one test data corresponding to each bit operation.
[0106] For example, such as Figure 4 As shown, Figure 4 The target byte data is "A", corresponding to ASCII code 65, which is "1000001" in binary. Using the bit-flip operation in the first mutation method, the target byte is mutated to obtain the mutated byte "0111110", which is 62 in decimal. The ASCII code "62" corresponds to the character ">", therefore, the test data obtained from the mutated byte is determined to be ">". Using the bit-add operation in the first mutation method, the target byte is mutated to obtain the mutated byte "1000010", from which the test data "B" is obtained. It is understandable that due to the numerical limitations of ASCII codes, the actual numerical settings need to be considered when performing bit-addition or bit-subtraction operations. The specific bit operation method of the first mutation method can be set according to the actual situation.
[0107] S206, transmit the test data to the target program and obtain the second response data returned by the target program in response to the test data;
[0108] S207, obtain the first data length of the first response data and the second data length of the second response data;
[0109] In one embodiment, after the test data is transmitted to the target program, the second response data generated by the target program in response to the test data is obtained, and the first data length of the first response data and the second data length corresponding to the second response data are obtained. The first data length can be a representation of the number of bytes included in the first response data, and the second data length can be a representation of the number of bytes included in the second response data.
[0110] For example, if the first response data is "404 Not found", then the length of the first data is 13; if the second response data is "405 Method Not Allowed", then the length of the second data is 22.
[0111] S208, using a difference degree algorithm based on the first response data, the second response data, the first data length, and the second data length, to determine the first difference degree between the first response data and the second response data;
[0112] In one embodiment, a difference degree algorithm is used to calculate the first difference degree between the first response data and the second response data based on the first response data, the second response data, the first data length and the second data length. The difference degree algorithm can be the formula (1) shown in step S103. The specific process of obtaining the first difference degree using the difference degree algorithm can be referred to step S103, which will not be elaborated here.
[0113] S209, Obtain a preset difference threshold and compare the first difference with the preset difference threshold;
[0114] S210, if the first difference degree is less than the preset difference degree threshold, then the target byte is determined to be a volatile byte;
[0115] In one embodiment, a preset difference threshold is obtained, and a first difference is compared with the preset difference threshold. If the first difference is less than the preset difference threshold, the target byte is determined to be a volatile byte. The preset difference threshold can be a threshold set according to the actual situation to determine the mutation probability of the target byte. The volatile byte can be a byte that is suitable for mutation during the test process when using initial data for fuzz testing.
[0116] For example, if the first difference is 0.8 and the preset difference threshold is 1, then since 0.8 is less than 1, the target byte can be considered to be a volatile byte.
[0117] Furthermore, if the first difference degree is greater than or equal to a preset difference degree threshold, then the second difference degree between the second response data and each third response data is obtained. If each second difference degree is greater than the preset difference degree threshold, then the target byte is determined to be a volatile byte. The method for obtaining the third response data can be as follows: obtaining other payload data from the payload data (excluding the initial data), obtaining the third response data corresponding to each other payload data, where the third response data can be data from a third response data set including the data responded to by the target program for each other payload data. For example, if the payload data includes "Data A", "Data B", and "Data C", and the initial data is "Data A", then the other payload data can be "Data B" and "Data C".
[0118] It should be noted that if the second difference degree between the second response data and each of the third response data is greater than the preset difference degree threshold, it can be considered that the variation of the test data may have tested unknown functional code of the target program. Therefore, the target byte is identified as a volatile byte, the test data is added to the payload data, and the test data is used as the initial data to proceed to step S203. By using the test data as the initial data to execute subsequent steps, the unknown functional code of the target program can be tested, thereby improving the comprehensiveness and accuracy of fuzz testing of the network protocol of the target program.
[0119] Furthermore, if there is a second difference degree less than a preset difference degree threshold among the second difference degrees between the second response data and each of the third response data, then the target byte is determined to be a non-volatile byte.
[0120] S211, Perform a second mutation operation on the initial data based on the second mutation method to obtain mutated data;
[0121] In one embodiment, the initial data is subjected to a second mutation operation based on a second mutation method to obtain at least one mutated data. The second mutation method may be to perform a second mutation operation on the target byte of the initial data using one or more methods. The mutated data may be the data obtained after performing the second mutation operation on the initial data. One initial data may correspond to one or more mutated data, and the specific settings may be configured according to the actual situation.
[0122] Specifically, the method for performing a second mutation operation on the initial data based on the second mutation method can be as follows: determine the byte type of the target byte; if the target byte is a volatile byte, obtain the byte sequence number of the target byte in the initial data; insert a preset string into the initial data based on the byte sequence number to obtain mutated data; the preset string is any string in the mutated character set, which can be a pre-set set containing at least one string, and the strings included in the mutated string set can be set according to the actual situation; or, insert a randomly generated character into the initial data based on the byte sequence number to obtain mutated data; or, replace the target byte of the initial data with a randomly generated character to obtain mutated data. Here, the byte sequence number can represent the ordinal number of the target byte in the initial data, for example, in the initial data "GET / HTTP / 1.1", the byte sequence number of "G" is "1"; the randomly generated character can be generated using any random generation algorithm.
[0123] For example, such as Figure 5 As shown, Figure 5The code generates the mutated data "aaa GET / HTTP / 1.1" by inserting the string "aaa" from the mutated string set before the target byte "G"; it generates the mutated data "bGET / HTTP / 1.1" by inserting the randomly generated character "b" before the target byte "G"; and it generates the mutated data "bET / HTTP / 1.1" by replacing the target byte "G" with the randomly generated character "b".
[0124] Furthermore, in addition to performing a second mutation operation on the initial data using the methods described above, mutated data can also be obtained by performing bitwise operations such as bit flipping, bit addition, or bit subtraction on the target byte. It is understandable that since the purpose of generating mutated data is to perform fuzz testing on the target program's network protocol using the mutated data, various bitwise operations can be performed on the target byte to generate mutated data. The specific method for generating mutated data can be set according to the actual situation.
[0125] It should be noted that when generating mutated data using the second mutation method, a feasible approach is as follows: If the target byte is a non-volatile byte, the test state of the target byte is determined based on a preset probability. If the test state indicates that the target byte needs to be tested, then the second mutation operation is performed on the target byte. The preset probability can be a pre-set probability used to determine whether to perform the second mutation operation on a non-volatile byte, such as 90%, and can be set according to actual conditions. The test state can be a state representing whether the target byte needs to be tested. If the test state of the target byte, determined based on the preset probability, indicates that testing is required, then the second mutation operation is performed on the target byte; if the test state indicates that testing is not required, then the test state is determined for the next target byte. This improves the testing efficiency of fuzzy testing of network protocols by reducing the testing of non-volatile bytes.
[0126] S212, transmit the mutated data to the target program and obtain the target program's running status;
[0127] In one embodiment, the mutated data is transmitted to the target program, and the running state of the target program after receiving the mutated data and processing it is obtained. The running state can be a characterization of the state in which the target program runs the mutated data, such as normal operation or a crash.
[0128] Specifically, the method for obtaining the running status can be as follows: by setting up a proxy plugin, the process status of the target program can be obtained in real time through the proxy plugin, and the running status of the target program can be determined based on the process status. If the proxy plugin finds that the process status of the target program is stuck for a long time, the running status of the target program is considered to be abnormal.
[0129] It should be noted that, since fuzz testing of the target program requires determining whether the target program will experience abnormal states due to the execution of mutated data, only one mutated data is transmitted to the target program at a time. After the test of that mutated data is completed, other mutated data are transmitted. This avoids the inability to determine the cause of the target program's abnormality due to the simultaneous transmission of multiple mutated data, thereby improving the testing efficiency of the target program's network protocol.
[0130] Furthermore, in addition to transmitting mutated data to the target program for fuzz testing, one or more data from the payload can be randomly transmitted to the target program for fuzz testing. This allows for fuzz testing of the target program's network protocol by transmitting different data, thereby improving the accuracy of fuzz testing.
[0131] S213, If the running status indicates that the target program has encountered an error, then obtain the kernel file that records the error in the target program;
[0132] In one embodiment, if the running status indicates that the target program has encountered an error, a kernel file recording the error of the target program is obtained. The kernel file can be a file generated by the operating system of the running terminal when the target program encounters an error, used to record the target program from the start of running based on the mutation data to the point where the target program encounters an error. Specifically, it can include data such as the memory status of the running terminal, the register status, and the specific location of the target program crash.
[0133] Specifically, since the proxy plugin can be used to obtain the running status of the target program in real time, when the proxy plugin detects that the running status of the target program is abnormal, it obtains the kernel file and transmits the kernel file to the test terminal running the test tool. The test tool can be a tool used to calculate the difference of the initial data and perform mutation operations.
[0134] S214, Restart the target program;
[0135] In one embodiment, if the target program crashes due to an anomaly during runtime based on the mutation data, the target program is restarted via the proxy plugin so that the network protocol can be fuzz-tested based on other mutation data.
[0136] It should be noted that the target byte can be a single byte or multiple bytes, such as two bytes or four bytes. To improve the accuracy of fuzz testing of network protocols based on initial data, a feasible method is as follows: Iterate through each byte of the initial data using a single-byte target byte, determining the first mutation method to generate test data for each byte. After determining the byte type of the target byte based on the test data, generate the corresponding mutated data for fuzz testing of the network protocol. After completing the fuzz testing with a single-byte target byte, repeat the fuzz testing steps sequentially with double-byte and four-byte target bytes. Specific settings can be configured according to actual conditions. It is understandable that when performing mutation operations on the target byte in the initial data, a step-by-step approach can be used to process each byte in the initial data, improving the accuracy of fuzz testing of network protocols by iterating through and testing each byte.
[0137] In the embodiments of this specification, by acquiring initial data and corresponding first response data, and second response data of the target program after performing a first mutation operation on the target byte of the initial data, and calculating the difference between the first and second response data, when the target byte is determined to be a volatile byte, a second mutation operation is performed on the target byte to obtain mutated data. Fuzz testing of the target program's network protocol is then performed based on the mutated data. This allows the determination of byte variability through test data generated by mutating the target byte of the initial data, and further network protocol testing of the program is performed based on the mutated data generated from the target byte. This reduces the testing time for bytes with a non-volatile variability level and improves the efficiency of fuzz testing and the accuracy of network protocol vulnerability detection improved by byte-level mutation operations. Furthermore, initial data for fuzz testing is selected based on the network protocol characteristics of the network through which the target program transmits data, thereby improving the accuracy of network protocol detection through fuzz testing based on valid data. Furthermore, multi-layer judgment is used to determine the byte type of the target byte and the probability of impact caused by the mutation of the target byte, thereby improving the accuracy of fuzz testing.
[0138] based on Figure 1 The scene shown below is an illustration; the following will combine... Figure 6 and Figure 7 This document provides a detailed description of the network protocol fuzzy testing device provided in the embodiments of this specification. It should be noted that... Figure 6 and Figure 7 The network protocol fuzzy testing device described herein is used to execute the embodiments of this specification. Figures 2 to 5 The methods shown in the embodiments are illustrated for ease of explanation, showing only the parts related to the embodiments of this specification. For specific technical details not disclosed, please refer to the embodiments of this specification. Figures 2 to 5The example shown.
[0139] Please see Figure 6 This document provides a schematic diagram of the structure of a network protocol fuzzy testing device as an embodiment of the present specification. Figure 6 As shown in the embodiments of this specification, the network protocol fuzzy testing device 1 may include: a response data acquisition unit 11, a test data acquisition unit 12, a difference determination unit 13, a mutation data acquisition unit 14, and a testing unit 15.
[0140] The response data acquisition unit 11 is used to acquire the initial data input to the target program, and the first response data output by the target program in response to the initial data;
[0141] The test data acquisition unit 12 is used to perform a first mutation operation on the target byte of the initial data using a first mutation method to obtain the test data corresponding to the initial data.
[0142] The difference determination unit 13 is used to acquire the second response data corresponding to the test data and determine the first difference between the first response data and the second response data based on the difference algorithm.
[0143] The mutated data acquisition unit 14 is used to perform a second mutation operation on the initial data based on the second mutation method to obtain mutated data if the first difference indicates that the target byte is a volatile byte;
[0144] Test unit 15 is used to transmit the mutated data to the target program and perform fuzz testing on the network protocol of the target program.
[0145] Optionally, the response data acquisition unit 11 is further configured to:
[0146] Obtain the network traffic data corresponding to the target program, and the protocol characteristics corresponding to the network traffic data;
[0147] Based on the protocol characteristics, the network traffic data is filtered to obtain the payload data corresponding to the network traffic data;
[0148] Iterate through the payload data to obtain initial data;
[0149] The initial data is input into the target program, and the first response data returned by the target program in response to the initial data is obtained, wherein the initial data is any data in the payload data.
[0150] Optionally, the test data acquisition unit 12 is further configured to:
[0151] Perform bit flipping on the target byte in the initial data to obtain the test data corresponding to the initial data; or,
[0152] Perform bitwise addition on the target byte to obtain the test data corresponding to the initial data; or,
[0153] Perform a bitwise subtraction operation on the target byte to obtain the test data corresponding to the initial data.
[0154] Optionally, the difference determination unit 13 is further configured to:
[0155] The test data is transmitted to the target program, and second response data is obtained from the target program in response to the test data.
[0156] Obtain the first data length of the first response data and the second data length of the second response data;
[0157] A difference algorithm is used to determine a first difference between the first response data and the second response data based on the first response data, the second response data, the first data length, and the second data length.
[0158] Optional, such as Figure 7 As shown, the network protocol fuzzy testing device 1 further includes a byte type determination unit 16, used for:
[0159] Obtain a preset difference threshold and compare the first difference with the preset difference threshold;
[0160] If the first difference is less than the preset difference threshold, then the target byte is determined to be a volatile byte.
[0161] Optionally, the response data acquisition unit 11 is further configured to:
[0162] Obtain other payload data from the payload data, wherein the other payload data is the data in the payload data other than the initial data;
[0163] Obtain a third response data set corresponding to each of the other load data, wherein the third response data set includes the third response data returned by the target program for each of the other load data;
[0164] The byte type determination unit 16 is further configured to:
[0165] If the first difference degree is greater than or equal to the preset difference degree threshold, then the second difference degree between the second response data and each of the third response data in the third response data set is obtained;
[0166] If each of the second differences is greater than the preset difference threshold, then the target byte is determined to be a volatile byte, the test data is added to the payload data, the test data is used as the initial data, and the process proceeds to the step of performing the first mutation operation on the target byte of the initial data using the first mutation method.
[0167] If the second difference degree is less than the preset difference degree threshold, then the target byte is determined to be a non-volatile byte.
[0168] Optionally, the mutation data acquisition unit 14 is further configured to:
[0169] If the target byte is a volatile byte, then obtain the byte sequence number of the target byte in the initial data;
[0170] Based on the byte sequence number, a preset string is inserted into the initial data to obtain mutated data, where the preset string is any string from the mutated character set; or,
[0171] Based on the byte sequence number, randomly generated characters are inserted into the initial data to obtain mutated data; or,
[0172] The target byte of the initial data is replaced with a randomly generated character to obtain mutated data.
[0173] Optionally, the mutation data acquisition unit 14 is further configured to:
[0174] If the target byte is a non-volatile byte, the test state of the target byte is determined based on a preset probability;
[0175] If the test status indicates that the target byte needs to be tested, then proceed to the step of inserting a preset string into the initial data based on the byte sequence number.
[0176] Optionally, the test unit 15 is further configured to:
[0177] The mutated data is transmitted to the target program to obtain the running status of the target program;
[0178] If the running status indicates that the target program has encountered an error, then obtain the kernel file that records the error of the target program;
[0179] Restart the target program.
[0180] In the embodiments of this specification, by acquiring initial data and corresponding first response data, and second response data of the target program after performing a first mutation operation on the target byte of the initial data, and calculating the difference between the first and second response data, when the target byte is determined to be a volatile byte, a second mutation operation is performed on the target byte to obtain mutated data. Fuzz testing of the target program's network protocol is then performed based on the mutated data. This allows the determination of byte variability through test data generated by mutating the target byte of the initial data, and further network protocol testing of the program is performed based on the mutated data generated from the target byte. This reduces the testing time for bytes with a non-volatile variability level and improves the efficiency of fuzz testing and the accuracy of network protocol vulnerability detection improved by byte-level mutation operations. Furthermore, initial data for fuzz testing is selected based on the network protocol characteristics of the network through which the target program transmits data, thereby improving the accuracy of network protocol detection through fuzz testing based on valid data. Furthermore, multi-layer judgment is used to determine the byte type of the target byte and the probability of impact caused by the mutation of the target byte, thereby improving the accuracy of fuzz testing.
[0181] This specification also provides a computer storage medium that can store multiple program instructions adapted to be loaded and executed by a processor as described above. Figures 1-5 The method steps of the illustrated embodiment can be found in the following documentation for detailed execution. Figures 1-5 The specific details of the illustrated embodiments will not be elaborated here.
[0182] This specification also provides an embodiment of a computer program product, which stores at least one instruction, said at least one instruction being loaded and executed by the processor as described above. Figures 1-5 The network protocol fuzz testing method described in the illustrated embodiment can be found in the following documentation for its specific execution process. Figures 1-5 The specific details of the illustrated embodiments will not be elaborated here.
[0183] Please see Figure 8 This document provides a schematic diagram of the structure of an electronic device as an embodiment of the present specification. Figure 8As shown, the electronic device 1000 may include: at least one processor 1001, such as a CPU; at least one network interface 1004; an input / output interface 1003; a memory 1005; and at least one communication bus 1002. The communication bus 1002 is used to enable communication between these components. The network interface 1004 may optionally include a standard wired interface or a wireless interface (such as a Wi-Fi interface). The memory 1005 may be high-speed RAM or non-volatile memory, such as at least one disk drive. Optionally, the memory 1005 may also be at least one storage device located remotely from the aforementioned processor 1001. Figure 8 As shown, the memory 1005, which serves as a computer storage medium, may include an operating system, a network communication module, an input / output interface module, and a network protocol fuzzy testing device program.
[0184] exist Figure 8 In the electronic device 1000 shown, the input / output interface 1003 is mainly used to provide an input interface for the user and to obtain the user input data.
[0185] In one embodiment, the processor 1001 can be used to call the network protocol fuzz testing device program stored in the memory 1005, and specifically perform the following operations:
[0186] Acquire the initial data input to the target program, and the first response data output by the target program in response to the initial data;
[0187] The target bytes of the initial data are subjected to a first mutation operation using a first mutation method to obtain the test data corresponding to the initial data.
[0188] Obtain the second response data corresponding to the test data, and determine the first difference between the first response data and the second response data based on the difference algorithm;
[0189] If the first difference indicates that the target byte is a volatile byte, then the initial data is subjected to a second mutation operation based on the second mutation method to obtain mutated data;
[0190] The mutated data is transmitted to the target program, and fuzz testing is performed on the network protocol of the target program.
[0191] Optionally, when the processor 1001 executes the process of acquiring initial data for the input target program and the first response data output by the target program in response to the initial data, it specifically performs the following operations:
[0192] Obtain the network traffic data corresponding to the target program, and the protocol characteristics corresponding to the network traffic data;
[0193] Based on the protocol characteristics, the network traffic data is filtered to obtain the payload data corresponding to the network traffic data;
[0194] Iterate through the payload data to obtain initial data;
[0195] The initial data is input into the target program, and the first response data returned by the target program in response to the initial data is obtained, wherein the initial data is any data in the payload data.
[0196] Optionally, when the processor 1001 performs a first mutation operation on the target byte of the initial data using a first mutation method to obtain the test data corresponding to the initial data, it specifically performs the following operations:
[0197] Perform bit flipping on the target byte in the initial data to obtain the test data corresponding to the initial data; or,
[0198] Perform bitwise addition on the target byte to obtain the test data corresponding to the initial data; or,
[0199] Perform a bitwise subtraction operation on the target byte to obtain the test data corresponding to the initial data.
[0200] Optionally, when the processor 1001 executes the process of acquiring the second response data corresponding to the test data and determining the first difference between the first response data and the second response data based on the difference algorithm, it specifically performs the following operations:
[0201] The test data is transmitted to the target program, and second response data is obtained from the target program in response to the test data.
[0202] Obtain the first data length of the first response data and the second data length of the second response data;
[0203] A difference algorithm is used to determine a first difference between the first response data and the second response data based on the first response data, the second response data, the first data length, and the second data length.
[0204] Optionally, after determining the first difference between the first response data and the second response data based on the difference algorithm, the processor 1001 further performs the following operations:
[0205] Obtain a preset difference threshold and compare the first difference with the preset difference threshold;
[0206] If the first difference is less than the preset difference threshold, then the target byte is determined to be a volatile byte.
[0207] Optionally, before performing the comparison between the first difference degree and the preset difference degree threshold, the processor 1001 further performs the following operations:
[0208] Obtain other payload data from the payload data, wherein the other payload data is the data in the payload data other than the initial data;
[0209] Obtain a third response data set corresponding to each of the other load data, wherein the third response data set includes the third response data returned by the target program for each of the other load data;
[0210] After performing the comparison between the first difference degree and the preset difference degree threshold, the processor 1001 further performs the following operations:
[0211] If the first difference degree is greater than or equal to the preset difference degree threshold, then the second difference degree between the second response data and each of the third response data in the third response data set is obtained;
[0212] If each of the second differences is greater than the preset difference threshold, then the target byte is determined to be a volatile byte, the test data is added to the payload data, the test data is used as the initial data, and the process proceeds to the step of performing the first mutation operation on the target byte of the initial data using the first mutation method.
[0213] If the second difference degree is less than the preset difference degree threshold, then the target byte is determined to be a non-volatile byte.
[0214] Optionally, when the processor 1001 performs a second mutation operation on the initial data based on the second mutation method to obtain mutated data, it specifically performs the following operations:
[0215] If the target byte is a volatile byte, then obtain the byte sequence number of the target byte in the initial data;
[0216] Based on the byte sequence number, a preset string is inserted into the initial data to obtain mutated data, where the preset string is any string from the mutated character set; or,
[0217] Based on the byte sequence number, randomly generated characters are inserted into the initial data to obtain mutated data; or,
[0218] The target byte of the initial data is replaced with a randomly generated character to obtain mutated data.
[0219] Optionally, when the processor 1001 performs a second mutation operation on the initial data based on the second mutation method to obtain mutated data, it specifically performs the following operations:
[0220] If the target byte is a non-volatile byte, the test state of the target byte is determined based on a preset probability;
[0221] If the test status indicates that the target byte needs to be tested, then proceed to the step of inserting a preset string into the initial data based on the byte sequence number.
[0222] Optionally, when the processor 1001 executes the process of transmitting the mutated data to the target program and performing fuzz testing on the network protocol of the target program, it specifically performs the following operations:
[0223] The mutated data is transmitted to the target program to obtain the running status of the target program;
[0224] If the running status indicates that the target program has encountered an error, then obtain the kernel file that records the error of the target program;
[0225] Restart the target program.
[0226] In the embodiments of this specification, by acquiring initial data and corresponding first response data, and second response data of the target program after performing a first mutation operation on the target byte of the initial data, and calculating the difference between the first and second response data, when the target byte is determined to be a volatile byte, a second mutation operation is performed on the target byte to obtain mutated data. Fuzz testing of the target program's network protocol is then performed based on the mutated data. This allows the determination of byte variability through test data generated by mutating the target byte of the initial data, and further network protocol testing of the program is performed based on the mutated data generated from the target byte. This reduces the testing time for bytes with a non-volatile variability level and improves the efficiency of fuzz testing and the accuracy of network protocol vulnerability detection improved by byte-level mutation operations. Furthermore, initial data for fuzz testing is selected based on the network protocol characteristics of the network through which the target program transmits data, thereby improving the accuracy of network protocol detection through fuzz testing based on valid data. Furthermore, multi-layer judgment is used to determine the byte type of the target byte and the probability of impact caused by the mutation of the target byte, thereby improving the accuracy of fuzz testing.
[0227] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. The storage medium can be a magnetic disk, optical disk, read-only memory (ROM), or random access memory (RAM), etc.
[0228] The above-disclosed embodiments are merely preferred embodiments of this specification and should not be construed as limiting the scope of this specification. Therefore, any equivalent variations made in accordance with the claims of this specification shall still fall within the scope of this specification.
Claims
1. A network protocol fuzzing method, characterized in that, The method includes: Acquire initial data input to the target program, and first response data output by the target program in response to the initial data, wherein the initial data is data that can be recognized and executed by the target program; The target byte of the initial data is subjected to a first mutation operation using a first mutation method to obtain test data corresponding to the initial data. The target byte is any byte in the initial data. The first mutation operation includes bit flipping, bit addition, or bit subtraction. Obtain the second response data corresponding to the test data, and determine the first difference between the first response data and the second response data based on the difference algorithm, wherein the difference algorithm is as follows: Where r represents the first response data. For the second response data, min_len(r, To obtain the first response data r and the second response data The length in bytes corresponding to the shortest data in the data set. For r and The former Edit distance of bytes, d2 is the distance between r and The former The edit distance is 1 byte, and d3 is the distance between r and... The former The edit distance is 1 byte, and d4 is the distance between r and... min_len(r, The edit distance is ) bytes; where the edit distance is the number of bytes that need to be modified to convert bytes in the first response data and the second response data into the same data. Obtain other payload data from the payload data, wherein the other payload data is the data in the payload data other than the initial data; Obtain the third response data set corresponding to the other load data, wherein the third response data set includes the third response data returned by the target program for each of the other load data; Obtain a preset difference threshold and compare the first difference with the preset difference threshold; If the first difference degree is less than the preset difference degree threshold, then the target byte is determined to be a volatile byte; If the first difference degree is greater than or equal to the preset difference degree threshold, then the second difference degree between the second response data and each of the third response data in the third response data set is obtained; If each of the second differences is greater than the preset difference threshold, indicating that the target byte has a probability of triggering the unknown function code of the target program, then the target byte is determined to be a volatile byte, the test data is added to the payload data, the test data is used as the initial data, and the process proceeds to the step of performing the first mutation operation on the target byte of the initial data using the first mutation method. If the second difference degree is less than the preset difference degree threshold, then the target byte is determined to be a non-volatile byte; If the first difference degree or the second difference degree indicates that the target byte is a volatile byte, then the initial data is subjected to a second mutation operation based on the second mutation method to obtain mutated data. The second mutation operation includes replacing the target byte with a random character, or inserting a preset string or a random character into the initial data according to the byte number of the target byte. The mutated data is transmitted to the target program, and fuzz testing is performed on the network protocol of the target program.
2. The method of claim 1, wherein, The process of acquiring initial data input to the target program and first response data output by the target program in response to the initial data includes: Obtain the network traffic data corresponding to the target program, and the protocol characteristics corresponding to the network traffic data; Based on the protocol characteristics, the network traffic data is filtered to obtain the payload data corresponding to the network traffic data; Iterate through the payload data to obtain initial data; The initial data is input into the target program, and the first response data returned by the target program in response to the initial data is obtained, wherein the initial data is any data in the payload data.
3. The method according to claim 1, characterized in that, The first mutation operation is performed on the target bytes of the initial data using the first mutation method to obtain the test data corresponding to the initial data, including: Perform bit flipping on the target byte in the initial data to obtain the test data corresponding to the initial data; or, Perform bitwise addition on the target byte to obtain the test data corresponding to the initial data; or, Perform a bitwise subtraction operation on the target byte to obtain the test data corresponding to the initial data.
4. The method according to claim 1, characterized in that, The step of obtaining the second response data corresponding to the test data and determining the first difference between the first response data and the second response data based on the difference algorithm includes: The test data is transmitted to the target program, and second response data is obtained from the target program in response to the test data. Obtain the first data length of the first response data and the second data length of the second response data; A difference algorithm is used to determine a first difference between the first response data and the second response data based on the first response data, the second response data, the first data length, and the second data length.
5. The method according to claim 1, characterized in that, The second mutation operation on the initial data based on the second mutation method to obtain mutated data includes: If the target byte is a volatile byte, then obtain the byte sequence number of the target byte in the initial data; Based on the byte sequence number, a preset string is inserted into the initial data to obtain mutated data, where the preset string is any string from the mutated character set; or, Based on the byte sequence number, randomly generated characters are inserted into the initial data to obtain mutated data; or, The target byte of the initial data is replaced with a randomly generated character to obtain mutated data.
6. The method according to claim 5, characterized in that, The second mutation operation on the initial data based on the second mutation method to obtain mutated data includes: If the target byte is a non-volatile byte, the test state of the target byte is determined based on a preset probability; If the test status indicates that the target byte needs to be tested, then proceed to the step of inserting a preset string into the initial data based on the byte sequence number.
7. The method according to claim 1, characterized in that, The step of transmitting the mutated data to the target program and performing fuzz testing on the network protocol of the target program includes: The mutated data is transmitted to the target program to obtain the running status of the target program; If the running status indicates that the target program has encountered an error, then obtain the kernel file that records the error of the target program; Restart the target program.
8. A network protocol fuzzy testing device, characterized in that, The device includes: A response data acquisition unit is used to acquire initial data input to a target program, and first response data output by the target program in response to the initial data, wherein the initial data is data that can be recognized and executed by the target program; The test data acquisition unit is used to perform a first mutation operation on the target byte of the initial data using a first mutation method to obtain test data corresponding to the initial data. The target byte is any byte in the initial data. The first mutation operation includes bit flipping, bit addition, or bit subtraction. The difference determination unit is used to acquire the second response data corresponding to the test data, and determine the first difference between the first response data and the second response data based on the difference algorithm, wherein the difference algorithm is: Where r represents the first response data. For the second response data, min_len(r, To obtain the first response data r and the second response data The length in bytes corresponding to the shortest data in the data set. For r and The former Edit distance of bytes, d2 is the distance between r and The former The edit distance is 1 byte, and d3 is the distance between r and... The former The edit distance is 1 byte, and d4 is the distance between r and... min_len(r, The edit distance is ) bytes; where the edit distance is the number of bytes that need to be modified to convert bytes in the first response data and the second response data into the same data. The response data acquisition unit is further configured to acquire other payload data in the payload data, wherein the other payload data is data other than the initial data in the payload data; acquire a third response data set corresponding to each of the other payload data, wherein the third response data set includes the third response data returned by the target program for each of the other payload data; A byte type determination unit is used to obtain a preset difference threshold, compare the first difference with the preset difference threshold, and if the first difference is less than the preset difference threshold, then the target byte is determined to be a volatile byte. The byte type determination unit is further configured to: if the first difference degree is greater than or equal to the preset difference degree threshold, obtain a second difference degree between the second response data and each of the third response data in the third response data set; if each of the second difference degrees is greater than the preset difference degree threshold, determine that the target byte is a volatile byte, add the test data to the payload data, use the test data as initial data, and proceed to the step of performing a first mutation operation on the target byte of the initial data using a first mutation method; if there is a second difference degree less than the preset difference degree threshold, determine that the target byte is a non-volatile byte. The mutated data acquisition unit is used to perform a second mutation operation on the initial data based on a second mutation method if the first difference degree or the second difference degree indicates that the target byte is a volatile byte, thereby obtaining mutated data. The second mutation operation includes replacing the target byte with a random character, or inserting a preset string or a random character into the initial data according to the byte sequence number of the target byte. The testing unit is used to transmit the mutated data to the target program and perform fuzz testing on the network protocol of the target program.
9. A computer storage medium storing a plurality of instructions adapted for loading by a processor and executing the steps of the method as claimed in any one of claims 1 to 7.
10. An electronic device, comprising: A processor and a memory; wherein the memory stores a computer program adapted to be loaded by the processor and to execute the steps of the method as claimed in any one of claims 1 to 7.
Citation Information
Patent Citations
Camera fuzzy test method based on difference degree feedback
CN117792967A